fix(browser): make socket discovery node_repl-safe

Author: danielcadev

.github/workflows/upstream-build-app.yml

@@ -14,10 +14,14 @@ on:
       - scripts/ci/upstream-dmg-*.js
       - scripts/validate-upstream-dmg.js
       - scripts/lib/candidate-install.sh
+      - scripts/lib/bundled-plugins.sh
+      - scripts/lib/browser-client-node-repl-runtime.test.js
+      - scripts/lib/patch-browser-client-iab-socket-scope.js
       - scripts/lib/patch-validation.js
       - scripts/lib/upstream-dmg-acceptance.js
       - scripts/lib/upstream-dmg-release-profile.js
       - scripts/lib/linux-features.js
+      - computer-use-linux/src/bin/codex-chrome-extension-host.rs
       - linux-features/**
       - .github/workflows/upstream-build-app.yml
   push:
@@ -33,10 +37,14 @@ on:
       - scripts/ci/upstream-dmg-*.js
       - scripts/validate-upstream-dmg.js
       - scripts/lib/candidate-install.sh
+      - scripts/lib/bundled-plugins.sh
+      - scripts/lib/browser-client-node-repl-runtime.test.js
+      - scripts/lib/patch-browser-client-iab-socket-scope.js
       - scripts/lib/patch-validation.js
       - scripts/lib/upstream-dmg-acceptance.js
       - scripts/lib/upstream-dmg-release-profile.js
       - scripts/lib/linux-features.js
+      - computer-use-linux/src/bin/codex-chrome-extension-host.rs
       - linux-features/**
       - .github/workflows/upstream-build-app.yml
   workflow_dispatch:
@@ -164,6 +172,13 @@ jobs:
           REBUILD_REPORT_DIR: ${{ github.workspace }}/upstream-acceptance
         run: make build-app DMG=/tmp/codex-upstream-ci/Codex.dmg
 
+      - name: Import staged Browser clients through node_repl
+        if: steps.acceptance-build.outcome == 'success'
+        env:
+          CODEX_NODE_REPL_PATH: ${{ github.workspace }}/codex-app/resources/node_repl
+          CODEX_STAGED_BUNDLED_PLUGINS_ROOT: ${{ github.workspace }}/codex-app/resources/plugins/openai-bundled/plugins
+        run: node --test scripts/lib/browser-client-node-repl-runtime.test.js
+
       - name: Upload upstream DMG metadata artifact
         # The transactional installer records a decision before returning a
         # rejected status, so diagnostics remain available on failed runs.

computer-use-linux/src/bin/codex-chrome-extension-host.rs

@@ -7,6 +7,7 @@ use std::{
     io::{self, BufRead, BufReader, ErrorKind, Read, Seek, SeekFrom, Write},
     net::Shutdown,
     os::unix::{
+        ffi::OsStrExt,
         fs::{MetadataExt, PermissionsExt},
         io::AsRawFd,
         net::{UnixListener, UnixStream},
@@ -27,6 +28,7 @@ const HOST_NAME: &str = "com.openai.codexextension";
 const SOCKET_DIR_ENV: &str = "CODEX_BROWSER_USE_SOCKET_DIR";
 const SESSIONS_DIR_ENV: &str = "CODEX_BROWSER_USE_SESSIONS_DIR";
 const SOCKET_DIR_NAME: &str = "codex-browser-use";
+const MAX_UNIX_SOCKET_PATH_BYTES: usize = 107;
 const ROLLOUT_POLL_INTERVAL: Duration = Duration::from_millis(500);
 const OBSERVED_TURN_TTL: Duration = Duration::from_secs(6 * 60 * 60);
 const ROLLOUT_SEARCH_MAX_DEPTH: usize = 5;
@@ -330,9 +332,10 @@ impl RolloutTracker {
 }
 
 fn main() -> Result<()> {
-    let socket_dir = socket_dir();
+    let effective_uid = unsafe { libc::geteuid() };
+    let socket_dir = socket_dir(effective_uid);
+    let socket_path = socket_path(&socket_dir)?;
     prepare_socket_dir(&socket_dir)?;
-    let socket_path = socket_path(&socket_dir);
     remove_socket_if_present(&socket_path)?;
 
     let listener = UnixListener::bind(&socket_path)
@@ -364,21 +367,16 @@ fn main() -> Result<()> {
     result
 }
 
-fn socket_dir() -> PathBuf {
+fn socket_dir(effective_uid: u32) -> PathBuf {
     if let Some(path) = env::var_os(SOCKET_DIR_ENV).filter(|value| !value.is_empty()) {
         return PathBuf::from(path);
     }
 
-    let runtime_dir = env::var_os("XDG_RUNTIME_DIR");
-    default_socket_dir(runtime_dir.as_deref(), unsafe { libc::geteuid() })
+    default_socket_dir(effective_uid)
 }
 
-fn default_socket_dir(runtime_dir: Option<&std::ffi::OsStr>, effective_uid: u32) -> PathBuf {
-    runtime_dir
-        .filter(|value| !value.is_empty())
-        .map(PathBuf::from)
-        .map(|path| path.join(SOCKET_DIR_NAME))
-        .unwrap_or_else(|| PathBuf::from(format!("/tmp/{SOCKET_DIR_NAME}-{effective_uid}")))
+fn default_socket_dir(effective_uid: u32) -> PathBuf {
+    PathBuf::from(format!("/tmp/{SOCKET_DIR_NAME}-{effective_uid}"))
 }
 
 fn sessions_root() -> Option<PathBuf> {
@@ -408,12 +406,23 @@ fn is_extension_id(value: &str) -> bool {
     value.len() == 32 && value.bytes().all(|byte| matches!(byte, b'a'..=b'p'))
 }
 
-fn socket_path(socket_dir: &Path) -> PathBuf {
+fn socket_path(socket_dir: &Path) -> Result<PathBuf> {
     let nonce = SystemTime::now()
         .duration_since(UNIX_EPOCH)
         .map(|duration| duration.as_nanos())
         .unwrap_or_default();
-    socket_dir.join(format!("extension-{}-{nonce}.sock", process::id()))
+    socket_path_for(socket_dir, process::id(), nonce)
+}
+
+fn socket_path_for(socket_dir: &Path, process_id: u32, nonce: u128) -> Result<PathBuf> {
+    let path = socket_dir.join(format!("extension-{process_id}-{nonce}.sock"));
+    if path.as_os_str().as_bytes().len() > MAX_UNIX_SOCKET_PATH_BYTES {
+        bail!(
+            "unix socket path exceeds the {MAX_UNIX_SOCKET_PATH_BYTES}-byte Linux limit: {}",
+            path.display()
+        );
+    }
+    Ok(path)
 }
 
 fn prepare_socket_dir(path: &Path) -> Result<()> {
@@ -1039,19 +1048,24 @@ mod tests {
     use super::*;
 
     #[test]
-    fn socket_directory_prefers_the_per_user_runtime_directory() {
+    fn socket_directory_default_is_scoped_by_uid() {
         assert_eq!(
-            default_socket_dir(Some(std::ffi::OsStr::new("/run/user/1000")), 1000),
-            PathBuf::from("/run/user/1000/codex-browser-use")
+            default_socket_dir(1000),
+            PathBuf::from("/tmp/codex-browser-use-1000")
         );
     }
 
     #[test]
-    fn socket_directory_fallback_is_scoped_by_uid() {
+    fn complete_socket_path_is_guarded_against_the_linux_limit() {
+        let short = socket_path_for(Path::new("/tmp/codex-browser-use-1000"), 42, 7).unwrap();
         assert_eq!(
-            default_socket_dir(None, 1000),
-            PathBuf::from("/tmp/codex-browser-use-1000")
+            short,
+            PathBuf::from("/tmp/codex-browser-use-1000/extension-42-7.sock")
         );
+
+        let long_dir = PathBuf::from("/tmp").join("x".repeat(MAX_UNIX_SOCKET_PATH_BYTES));
+        let error = socket_path_for(&long_dir, 42, 7).unwrap_err();
+        assert!(error.to_string().contains("unix socket path exceeds"));
     }
 
     #[test]

scripts/lib/browser-client-node-repl-runtime.test.js

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+"use strict";
+
+const assert = require("node:assert/strict");
+const { spawn } = require("node:child_process");
+const fs = require("node:fs");
+const path = require("node:path");
+const readline = require("node:readline");
+const test = require("node:test");
+const { pathToFileURL } = require("node:url");
+
+const runtimePath = process.env.CODEX_NODE_REPL_PATH;
+const pluginsRoot = process.env.CODEX_STAGED_BUNDLED_PLUGINS_ROOT;
+
+function runNodeReplImport(runtime, clients) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(runtime, [], {
+      env: {
+        ...process.env,
+        CODEX_BROWSER_USE_SOCKET_DIR: "/tmp/codex-browser-use-runtime-test",
+      },
+      stdio: ["pipe", "pipe", "pipe"],
+    });
+    const stdout = readline.createInterface({ input: child.stdout });
+    let stderr = "";
+    let settled = false;
+
+    const finish = (error, value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      stdout.close();
+      child.kill("SIGTERM");
+      if (error) reject(error);
+      else resolve(value);
+    };
+
+    const send = (message) => child.stdin.write(`${JSON.stringify(message)}\n`);
+    const code = `${clients
+      .map((client) => `await import(${JSON.stringify(pathToFileURL(client).href)});`)
+      .join("")}nodeRepl.write("imports-ok")`;
+    const timer = setTimeout(
+      () => finish(new Error(`node_repl import timed out: ${stderr}`)),
+      20_000,
+    );
+
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("error", (error) => finish(error));
+    child.on("exit", (codeValue, signal) => {
+      if (!settled) {
+        finish(
+          new Error(
+            `node_repl exited before the import response (code=${codeValue}, signal=${signal}): ${stderr}`,
+          ),
+        );
+      }
+    });
+    stdout.on("line", (line) => {
+      let message;
+      try {
+        message = JSON.parse(line);
+      } catch {
+        return;
+      }
+
+      if (message.id === 1) {
+        send({ jsonrpc: "2.0", method: "notifications/initialized", params: {} });
+        send({
+          jsonrpc: "2.0",
+          id: 2,
+          method: "tools/call",
+          params: {
+            name: "js",
+            arguments: {
+              code,
+              timeout_ms: 10_000,
+              title: "Import staged Browser clients",
+            },
+          },
+        });
+      }
+
+      if (message.id === 2) {
+        const text = message.result?.content
+          ?.filter((item) => item.type === "text")
+          .map((item) => item.text)
+          .join("");
+        if (message.result?.isError) {
+          finish(new Error(`node_repl import failed: ${text || stderr}`));
+        } else {
+          finish(null, text);
+        }
+      }
+    });
+
+    send({
+      jsonrpc: "2.0",
+      id: 1,
+      method: "initialize",
+      params: {
+        protocolVersion: "2025-06-18",
+        capabilities: {},
+        clientInfo: { name: "codex-browser-client-runtime-test", version: "1" },
+      },
+    });
+  });
+}
+
+test(
+  "staged Browser and Chrome clients import through the real node_repl runtime",
+  { skip: !runtimePath || !pluginsRoot },
+  async () => {
+    const clients = ["browser", "chrome"].map((plugin) =>
+      path.join(pluginsRoot, plugin, "scripts", "browser-client.mjs"),
+    );
+    assert.ok(fs.existsSync(runtimePath), `node_repl runtime not found: ${runtimePath}`);
+    for (const client of clients) {
+      assert.ok(fs.existsSync(client), `staged Browser client not found: ${client}`);
+    }
+
+    assert.equal(await runNodeReplImport(runtimePath, clients), "imports-ok");
+  },
+);

scripts/lib/patch-browser-client-iab-socket-scope.js

@@ -21,16 +21,16 @@ if (!source.includes(socketDirMarker)) {
   const socketDirectoryMatches = [...source.matchAll(socketDirectoryPattern)];
   if (socketDirectoryMatches.length === 1) {
     const [target, resolver, platform, windowsSocket] = socketDirectoryMatches[0];
+    const userInfoImport =
+      'import{userInfo as codexLinuxBrowserUseUserInfo}from"node:os";';
     const helper =
-      `function codexLinuxBrowserUseSocketDir(){let e=process.env.CODEX_BROWSER_USE_SOCKET_DIR;` +
-      `if(typeof e==="string"&&e.length>0)return e;let r=process.env.XDG_RUNTIME_DIR;` +
-      `if(typeof r==="string"&&r.length>0)return r.replace(/\\\/+$/,"")+"/codex-browser-use";` +
-      `let t=typeof process.getuid==="function"?process.getuid():null;` +
+      `function codexLinuxBrowserUseSocketDir(){let e=globalThis.nodeRepl?.env?.CODEX_BROWSER_USE_SOCKET_DIR;` +
+      `if(typeof e==="string"&&e.length>0)return e;let t=codexLinuxBrowserUseUserInfo().uid;` +
       `if(Number.isInteger(t)&&t>=0)return \`/tmp/codex-browser-use-\${t}\`;` +
       `throw Error("Browser Use cannot resolve a per-user Linux socket directory")}${socketDirMarker}`;
     const replacement =
       `${resolver}=${platform}=>${platform}==="win32"?${windowsSocket}:codexLinuxBrowserUseSocketDir()`;
-    source = helper + source.replace(target, replacement);
+    source = userInfoImport + helper + source.replace(target, replacement);
   } else if (source.includes("/tmp/codex-browser-use")) {
     process.stderr.write(
       `WARN: Expected one Browser Use socket-directory resolver, found ${socketDirectoryMatches.length}; leaving its path unchanged\n`,

scripts/lib/patch-browser-client-iab-socket-scope.test.js

@@ -7,12 +7,11 @@ const fs = require("node:fs");
 const os = require("node:os");
 const path = require("node:path");
 const test = require("node:test");
-const vm = require("node:vm");
 const { pathToFileURL } = require("node:url");
 
 const patcher = path.join(__dirname, "patch-browser-client-iab-socket-scope.js");
 
-test("Linux socket discovery uses the override, runtime directory, then UID fallback", () => {
+test("Linux socket discovery uses the bridge override then a deterministic UID path", async () => {
   const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "codex-user-socket-dir-"));
   const clientPath = path.join(workspace, "browser-client.mjs");
   const fixture =
@@ -26,29 +25,38 @@ test("Linux socket discovery uses the override, runtime directory, then UID fall
     assert.equal(firstPatch.status, 0, firstPatch.stderr);
     const patched = fs.readFileSync(clientPath, "utf8");
     assert.match(patched, /codexLinuxPerUserBrowserSocketDir/);
-
-    const resolve = (env, uid = 1000) => {
-      const context = { process: { env, getuid: () => uid } };
-      context.globalThis = context;
-      vm.runInNewContext(patched, context);
-      return context.result;
+    assert.doesNotMatch(patched, /\bprocess\./);
+
+    let importIndex = 0;
+    const resolve = async (env) => {
+      globalThis.nodeRepl = { env };
+      delete globalThis.result;
+      await import(`${pathToFileURL(clientPath).href}?socket-case=${importIndex++}`);
+      return globalThis.result;
     };
     assert.equal(
-      resolve({ CODEX_BROWSER_USE_SOCKET_DIR: "/custom/browser-sockets" }),
+      await resolve({ CODEX_BROWSER_USE_SOCKET_DIR: "/custom/browser-sockets" }),
       "/custom/browser-sockets",
     );
+    const expectedDefault = `/tmp/codex-browser-use-${os.userInfo().uid}`;
+    assert.equal(
+      await resolve({ XDG_RUNTIME_DIR: "/run/user/1000/" }),
+      expectedDefault,
+    );
     assert.equal(
-      resolve({ XDG_RUNTIME_DIR: "/run/user/1000/" }),
-      "/run/user/1000/codex-browser-use",
+      await resolve({ XDG_RUNTIME_DIR: `/run/user/1000/${"x".repeat(200)}` }),
+      expectedDefault,
     );
-    assert.equal(resolve({}, 1001), "/tmp/codex-browser-use-1001");
+    assert.equal(await resolve({}), expectedDefault);
 
     const secondPatch = spawnSync(process.execPath, [patcher, clientPath, "--socket-dir-only"], {
       encoding: "utf8",
     });
     assert.equal(secondPatch.status, 0, secondPatch.stderr);
     assert.equal(fs.readFileSync(clientPath, "utf8"), patched);
   } finally {
+    delete globalThis.nodeRepl;
+    delete globalThis.result;
     fs.rmSync(workspace, { recursive: true, force: true });
   }
 });

tests/scripts_smoke.sh

@@ -7297,6 +7297,8 @@ test_browser_plugin_renamed_upstream_staging() {
     assert_contains "$browser_dir/scripts/browser-client.mjs" "codexLinuxFileUrlPolicy"
     assert_contains "$browser_dir/scripts/browser-client.mjs" "codexLinuxIabSocketScope"
     assert_contains "$browser_dir/scripts/browser-client.mjs" "codexLinuxPerUserBrowserSocketDir"
+    assert_contains "$browser_dir/scripts/browser-client.mjs" "codexLinuxBrowserUseUserInfo"
+    assert_not_contains "$browser_dir/scripts/browser-client.mjs" "process.env.CODEX_BROWSER_USE_SOCKET_DIR"
     assert_not_contains "$browser_dir/scripts/browser-client.mjs" '"/tmp/codex-browser-use"'
     assert_contains "$browser_dir/scripts/browser-client.mjs" 'protocol==="file:"'
     assert_not_contains "$browser_dir/scripts/browser-client.mjs" 'protocol==="data:"'
@@ -8142,6 +8144,8 @@ test_chrome_plugin_staging() {
     assert_not_contains "$chrome_dir/scripts/browser-client.mjs" 'await import("node:net")'
     assert_contains "$chrome_dir/scripts/browser-client.mjs" "codexLinuxSiteStatusAllowlistFallback"
     assert_contains "$chrome_dir/scripts/browser-client.mjs" "codexLinuxPerUserBrowserSocketDir"
+    assert_contains "$chrome_dir/scripts/browser-client.mjs" "codexLinuxBrowserUseUserInfo"
+    assert_not_contains "$chrome_dir/scripts/browser-client.mjs" "process.env.CODEX_BROWSER_USE_SOCKET_DIR"
     assert_not_contains "$chrome_dir/scripts/browser-client.mjs" '"/tmp/codex-browser-use"'
     assert_not_contains "$chrome_dir/scripts/browser-client.mjs" "codexLinuxIabSocketScope"
     assert_contains "$chrome_dir/skills/control-chrome/SKILL.md" "agent.browsers.list()"